Skip to content

[Snyk] Security upgrade eslint from 9.39.4 to 10.0.0 #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
snyk-io wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade eslint from 9.39.4 to 10.0.0 #75

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@
"@modelcontextprotocol/vitest-config": "workspace:^",
"@types/eventsource": "catalog:devTools",
"@typescript/native-preview": "catalog:devTools",
"eslint": "catalog:devTools",
"eslint": "10.0.0",

@kilo-code-bot kilo-code-bot Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[CRITICAL]: pnpm-lock.yaml is not updated for this dependency change and CI install will fail

This PR hardcodes "eslint": "10.0.0" here, but pnpm-lock.yaml is unchanged on the branch and still resolves eslint@9.39.4 everywhere (confirmed: no eslint@10 entry in the lockfile). pnpm's default --frozen-lockfile (used in CI) will reject the mismatch and the packages/server install/build/lint steps will fail. Snyk's own PR warning called this out: *"Failed to update the pnpm-lock.yaml, please update manually before merging."

Before this can merge, run pnpm install so the lockfile records eslint@10.0.0, and commit the regenerated pnpm-lock.yaml.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@kilo-code-bot kilo-code-bot Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[WARNING]: Hardcoding 10.0.0 diverges from the catalog:devTools eslint and creates version skew with sibling packages

The repo uses a pnpm catalog: eslint: ^9.39.2 is defined in pnpm-workspace.yaml and every other package pulls eslint via catalog:devTools. Pinning a bare 10.0.0 here forks @modelcontextprotocol/server off the catalog, so it will run a different major of eslint than client, core-internal, core, etc. This defeats the catalog's purpose (single-source version management) and is easy to regress on the next catalog bump.

Consider either (a) updating the catalog eslint entry to 10.0.0 (and bumping the whole workspace together), or (b) keeping catalog:devTools and updating the catalog value — rather than a one-off hardcoded version in a single package.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@kilo-code-bot kilo-code-bot Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[WARNING]: ESLint v10 is a major bump; companion devDeps remain pinned to v9-era ranges and may be incompatible

eslint-config-prettier, eslint-plugin-n, typescript-eslint, and @eslint/js are still catalog:devTools, which currently resolve to v9-compatible versions (@eslint/js: ^9.39.2, typescript-eslint: ^8.48.1, eslint-plugin-n: ^17.23.1). ESLint v10 drops Node <20.19 and the legacy .eslintrc system; flat-config plugins often require a matching major. Mixing eslint@10 with v9-era companion plugins risks peer-dependency and runtime incompatibilities in pnpm run lint.

Verify the companion lint plugins support eslint@10 (and that this repo's flat config / Node version satisfy v10 requirements) before merging; bump the companions in lockstep if needed.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@kilo-code-bot kilo-code-bot Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[SUGGESTION]: Add a changeset for this dependency change

The repo maintains .changeset/ and uses changesets for releases. A dependency bump (even a dev dependency) normally warrants a changeset so downstream consumers / release notes reflect it. Consider adding a .changeset/*.md describing the eslint major bump in packages/server.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

"eslint-config-prettier": "catalog:devTools",
"eslint-plugin-n": "catalog:devTools",
"prettier": "catalog:devTools",
Expand Down
Loading